Forensic Artifact Analysis Using Autopsy: File System Reconstruction and Timeline Carving

Joshua A. Wortz

doi:10.5281/zenodo.22287669

Forensic Artifact Analysis Using Autopsy: File System Reconstruction and Timeline Carving

Forensic artifact investigation using Autopsy, examining file system timestamps, deleted inode carving, and keyword index analysis.

Author

Joshua A. Wortz MSCOL, CISSP ORCID

Institution / Context University of San Diego

Format / Report Type Academic Research Paper / CSOL590

Published / Revised January 26, 2026 (Rev. Oct 2026)

Download PDF DOI 10.5281/zenodo.22287669 Open in New Tab Cite Paper

Table of Contents

Abstract
Research Paper Body
- References

Abstract

Academic research analysis exploring examine the evidence using autopsy within the context of Cyber Incident Response and Computer Network Forensics.

Research Paper Body

Open Autopsy Figure 1 Autopsy has opened.
Create new case Figure 2 A new case was created.
Add evidence Figure 3 Evidence was added through the USB drive image from last assignment.
Select Ingest Options Figure 4 Options were selected.
Review results Figure 5 Home Screen View.
Find the deleted file Figure 6 The deleted syllabus file was located.
Note dates and hash value Figure 7 Dates and hash from the deleted file.
Add in original image Figure 8 Added Original Image
Find the original file Figure 9 Original File location 10.Are the dates the same? Yes, the dates are the same. 11.Are the hash values the same? No, the hashes are different 12.Can you tell when the file was deleted? The file was deleted at 16:27 {ST

References

Wortz, J. (2026). Various Images [Digital]. Personal PC, Oceanside, CA.

Document Viewer

Cite This Academic Research

Standardized APA 7th Edition reference and RFC-compliant BibTeX entry for scholarly literature reviews, course papers, and citation managers (Zotero, Mendeley, JabRef).

APA 7th Edition

Wortz, J. A. (2026). Forensic Artifact Analysis Using Autopsy: File System Reconstruction and Timeline Carving. University of San Diego. https://doi.org/10.5281/zenodo.22287669

BibTeX Entry

@techreport{wortz2026csol590exami,
  author      = {Wortz, Joshua A.},
  title       = {Forensic Artifact Analysis Using Autopsy: File System Reconstruction and Timeline Carving},
  institution = {University of San Diego},
  year        = {2026},
  month       = {January},
  type        = {Academic Research Paper / CSOL590},
  url         = {https://codeandcypher.com/papers/csol590-examine-the-evidence-using-autopsy/},
  doi         = {10.5281/zenodo.22287669}
}

Abstract#

Research Paper Body#

References#

Document Viewer

Cite This Academic Research

Abstract

Research Paper Body

References